elharo opened a new issue, #138: URL: https://github.com/apache/maven-dependency-tree/issues/138
## Summary Two API-hygiene problems on `DefaultDependencyNode`: 1. `getChildren()` returns the internal mutable list (`src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:136-138`). Callers can add/remove/replace children and corrupt the graph. The builders wrap children in `Collections.unmodifiableList` when constructing (`DefaultDependencyCollectorBuilder.java:233`, `DefaultDependencyGraphBuilder.java:161`), so the mutability is mostly incidental — but the `setChildren`/`getChildren` contract leaves the door open, and `BuildingDependencyNodeVisitor` relies on mutating children of the freshly cloned nodes (so it cannot simply be made immutable everywhere without a builder). 2. The class does not override `equals`/`hashCode`. Combined with identity-based comparisons (see the related `AncestorOrSelfDependencyNodeFilter` issue), value-based matching against rebuilt/cloned trees is impossible. ## Suggested fix Document the mutation contract clearly, or return an unmodifiable view from `getChildren()`; and add value-based `equals`/`hashCode` (e.g. keyed on artifact coordinates) if identity semantics are not intentional. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
